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«Date» 


Re: Notice of Data Breach 
Dear «Name»: 

We are writing to share important information about a recent incident involving Missouri Southern State University that 
may have affected your personal information. 

What Happened 

On January 9, 2019 the University was alerted to a possible cybersecurity attack triggered by a phishing email. The email 
contained a link, which, when clicked, allowed the perpetrator to potentially copy that employee’s Office 365 account. 
Unfortunately, several employees fell victim to the fraudulent scheme. As soon as it detected this attack, the University 
contacted law enforcement and was directed to delay notification of potentially affected individuals until its investigation 
was complete. The University immediately engaged a leading forensic investigation firm to look into the matter and 
undertook enhancements to its already robust IT systems to block potential email exploitation, including a mass password 
reset of all employee Office 365 accounts. 

What Information Was Involved 


The University analyzed the entire contents of the impacted Office 365 accounts. The emails and attachments in the 
accounts contained, among other things, first and last names, dates of birth, home addresses, email addresses, telephone 
numbers, and social security numbers. In late March, April, and early May, the University identified emails containing 
personal information that may have been compromised by the attack. In mid-May, the University confirmed that your first 
and last name and social security number were contained in the impacted accounts. Please be assured that the 
investigation has not uncovered any evidence of actual misuse of your personal information. 

What We Are Doing 

Once the University discovered this attack, it took immediate steps to analyze and improve security and monitoring of its 
Office 365 accounts containing sensitive information. As part of the investigation and remediation efforts, the University 
also engaged a forensics team, other cybersecurity experts, law enforcement officers, and the attorney general’s office. 
Although it appears that the risk of harm to you is minimal as a result of this incident; the University started working 
straightaway to notify impacted individuals once the investigation was complete and the results were communicated with 
law enforcement and other regulators. 

Accordingly, to you and others who may have been inconvenienced by this unfortunate event, the University is offering, 
among other things, 24 months of complimentary credit monitoring and $1 million in identity theft insurance. You may 
sign up for this service by following the instructions included in Attachment A . 
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What You Can Do 


Regardless of whether you elect to receive credit monitoring and identity protection services, the University recommends 
that you remain vigilant in regularly reviewing and monitoring all account statements and credit histories to guard against 
any unauthorized transactions. If any suspicious or unusual activity is discovered, please contact your financial institution 
or call the number on the back of your payment card. Attachment B contains more details about steps you can take to 
protect against identity theft and fraud, including how to request a credit freeze or how to file a police report. 

For More Information 


First and foremost, we want to reinforce that keeping the personal information of our MSSU employees, candidates, 
students, and alumni safe and secure is of the utmost importance to us. We can assure you that as soon as we determined 
that some personal information may have been involved, we took swift action to address the issue and protect everyone 
who may have been affected. Anyone with questions regarding this incident is encouraged to contact the call center at 
(800) 395-3686, which is described in more detail in Attachment A . We sincerely regret that this incident occurred, and 
we apologize for any inconvenience that it may have caused. 


Very truly yours, 


Missouri Southern State University 
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ATTACHMENT A 


The following services are available for 24 months from the date of enrollment: 

MyIDCare™ Identity Protection Services: This service offers single bureau continuous credit monitoring through 
Experian, cyber scan dark web monitoring, fully managed recovery, $1 million identity theft insurance and unlimited 
access to the ID Experts member service team. Additionally, ID Experts will provide complete restoration services to 
ensure that if you fall victim to identity theft or have any irregularities in your accounts an ICFE Certified Recovery 
Advocate will work on your behalf to remove all fraud from your records. Moreover, ID Experts will remediate all forms 
of identity theft, including medical identity theft. 

To enroll in this service, you will need to contact ID Experts, our identity protection service provider. You may sign up 
online at https://app.mvidcare.com/account-creation/protect or by phone by calling (800) 395-3686 using the enrollment 
code above, which may be activated through September 10, 2019. ID Experts representatives are available Monday 
through Friday from 7 am - 7 pm Central Time. 


ATTACHMENT B 


Provided below are names and contact information for the three major United States credit reporting agencies and 
additional information about steps you can take to: obtain a free credit report; to place a fraud alert, credit freeze, or credit 
lock on your credit report; and to protect your information. If you believe you are a victim of fraud or identity theft you 
should consider contacting your local law enforcement agency, your state’s attorney general, or the Federal Trade 
Commission. 


INFORMATION ON OBTAINING A FREE CREDIT REPORT 


Residents of the United States are entitled to one free credit report annually from each of the three major credit reporting 
agencies. To order your free credit reports, visit www.annualcreditreport.com or call toll-free (877) 322-8228. 

INFORMATION ON FRAUD ALERTS, CREDIT FREEZES AND CREDIT LOCKS 


To place a fraud alert, credit freeze, or credit lock on your credit report, you must contact the one of the three credit 
reporting agencies below: 


Equifax: 

Consumer Fraud Division 
P.O. Box 740256 
Atlanta, GA 30374 
1-888-766-0008 
www.equifax.com 


Experian: 

Credit Fraud Center 
P.O. Box 9554 
Allen, TX 75013 
1-888-397-3742 
www.experian.com 


TransUnion: 

TransUnion LLC 
P.O. Box 2000 
Chester, PA 19022-2000 
1-800-680-7289 
www.transunion.com 


Fraud Alert: To place a fraud alert, contact any of the three major credit reporting agencies listed above and request that 
a fraud alert be put on your file. The agency that you contacted must notify the other two agencies. A fraud alert is free 
and lasts 90 days, but can be renewed. A fraud alert indicates to anyone requesting your credit file that you suspect you 
are a possible victim of fraud. A fraud alert does not impact your ability to get a loan or credit. Instead, it alerts a business 
that your personal information might have been compromised and requires that business to verify your identity before 
issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it might protect 
against someone else obtaining credit in your name. 


Credit Freeze: Unlike a fraud alert, you must place a credit freeze on your credit file with each credit reporting agency. A 
credit freeze prohibits the agency from releasing information from a credit report until it is lifted. When a credit freeze is 
in place, no one can open a new account. As a result, a credit freeze may delay, interfere with, or prevent the timely 
approval of any requests you make for new loans, credit, mortgages, employment, housing, or other services. 
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A credit freeze generally lasts until you lift or remove it, although in some jurisdictions it will expire after seven years. 
The cost to place a credit freeze is typically between $5.00 and $10.00 each time you place a freeze, but may vary by 
jurisdiction. (In Massachusetts, for example, you may be charged no more than $5.00.) Certain jurisdictions may also 
permit a credit reporting agency to charge you similar fees to lift or remove the freeze. If you have been a victim of 
identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift, or 
remove a credit freeze. 

To place a credit freeze, contact the three credit reporting agencies listed above and provide the personal information 
required by each agency. Typically, this information will include: full name, with middle initial; social security number; 
date of birth; current address and previous addresses for the past five years; and applicable fee or incident report or 
complaint with a law enforcement agency. The request should also include a copy of a government-issued identification 
card, such as a driver’s license, state, or military identification card, and a copy of a utility bill, bank, or insurance 
statement. Each copy should be legible, display your name and current mailing address, and the date of issue. The credit 
reporting agencies have three business days after receiving your request to place a credit freeze on your credit report. The 
credit bureaus must also send written confirmation to you within five business days. 

To temporarily lift a credit freeze to allow a specific entity or individual access to your credit report, you must call or send 
a written request to the credit reporting agencies by mail and include proper identification (e.g., name, address, and social 
security number) and the personal identification number or password provided to you when you placed the credit freeze as 
well as the identities of those entities or individuals you would like to receive your credit report or the specific period of 
time you want the credit report available. The credit reporting agencies have three business days after receiving your 
request to temporarily lift the credit freeze for those identified entities or for the specified period of time. 

To remove a credit freeze, you must send a written request to each of the three credit bureaus by mail and include proper 
identification (e.g., name, address, and social security number) and the personal identification number or password 
provided to you when you placed the credit freeze. The credit bureaus have three business days after receiving your 
request to remove the freeze. 

Credit Lock: Like a credit freeze, a credit lock restricts access to your credit report and prevents anyone from opening an 
account until unlocked. Unlike credit freezes, your credit can typically be unlocked online without delay. To lock your 
credit, contact all three credit reporting agencies listed above and complete a credit lock agreement. The cost of a credit 
lock varies by agency, which typically charges monthly fees. 

ADDITIONAL STEPS YOU CAN TAKE TO PROTECT YOUR INFORMATION 

Review Your Account Statements: Carefully review your bank, credit card, and other account statements every month 
to ensure that all of your account activity is valid. Report any questionable charges promptly and in writing to the card or 
account issuer. 

Check Your Credit Report: Check your credit report periodically to ensure that all your information is correct. You can 
obtain a free credit report once per year by visiting www.annualcreditreport.com or by calling (877) 322-8228. Carefully 
reviewing your credit report can help you spot problems and address them quickly. If you have any questions about your 
credit report or notice any inaccuracies, contact the relevant consumer reporting agency promptly at the telephone number 
listed on the report. 

Obtain or File a Police Report: Certain jurisdictions (e.g., Massachusetts) give you the right to obtain any police report 
filed with respect to this incident. You also have the right to file a police report and obtain a copy of it if you are the 
victim of identity theft. 

Contact the Office of the State Attorney General: You may contact the Office of the State Attorney General at the 
contact information found in Attachment C . 

Consult the Federal Trade Commission: You may also contact the United States Federal Trade Commission (“FTC”) 
for further information on fraud alerts, credit freezes, credit locks, and how to protect yourself from identity theft. The 
FTC can be contacted at 400 7th St. SW, Washington, DC 20024; telephone 1-877-382-4357; or 
www.consumer.gov/idtheft . 
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ATTACHMENT C 


Alabama 

501 Washington Avenue 
P.O. Box 300152 
Montgomery, AL 36130-0152 
(334) 242-7300 
http://www.ago.state.al.us/ 

Alaska 

1031 W. 4th Avenue, Suite 200 
Anchorage, AK 99501-1994 
(907) 269-5602 

http://www.law.state.ak.us/index.html 

Arizona 

1275 W. Washington Street 
Phoenix, AZ 85007 
(602) 542-4266 
http://www.azag.gov/ 

Arkansas 

323 Center St., Suite 200 
Little Rock, AR 72201-2610 
(800) 482-8982 
http://www.ag.arkansas.gov/ 

California 

1300 I St., Suite 1740 
Sacramento, CA 95814 
(916) 445-9555 
http://ag.ca.gov/ 

Colorado 

1300 Broadway, 10th Floor 
Denver, CO 80203 
(720) 508-6000 

http://www.coloradoattomevgeneral.g 

ov/ 

Connecticut 
55 Elm Street 
Hartford, CT 06106 
(860) 808-5318 
http://www.ct.gov/ag/ 

Delaware 

820 N. French Street 
Wilmington, DE 19801 
(302) 577-8400 

http://attomevgeneral.delaware.gov/ 

District of Columbia 

441 4th Street, NW, Suite 1100S 

Washington, DC 20001 

(202) 727-3400 

http://oag.dc.gov/ 


State Attorneys General Contact List 

Florida 

The Capitol, PL 01 
Tallahassee, FL 32399-1050 
(850)414-3300 
http://mvfloridalegal.com/ 

Georgia 

40 Capitol Square, SW 
Atlanta, GA 30334-1300 
(404) 656-3300 
http://law.ga.gov/ 

Hawaii 

425 Queen Street 
Honolulu, HI 96813 
(808) 586-1500 
http://ag.hawaii.gov/ 

Idaho 

700 W. Jefferson Street, Suite 210 
P.O. Box 83720 
Boise, ID 83720-1000 
(208) 334-2400 
http://www.ag.idaho.gov/ 

Illinois 

100 W. Randolph Street 
Chicago, IL 60601 
(312)814-3000 

http://illinoisattomevgeneral.gov/ 

Indiana 

302 West Washington Street, 5 ^ Floor 
Indianapolis, IN 46204 
(317) 232-6201 

http://www.in.gov/attomevgeneral/ 

Iowa 

1305 E. Walnut 

Des Moines, IA 50319 

(515)281-5164 

http://www.iowaattornevgeneral.gov 

Kansas 

120 S.W. 10th Avenue, 2 nd Floor 
Topeka, KS 66612-1597 
(785)296-2215 
https://www.ag.ks.gov/ 

Kentucky 

700 Capitol Avenue, Suite 118 
Frankfort, KY 40601 
(502) 696-5300 
http://ag.kv.gov/ 


Louisiana 

P.O. Box 94095 

Baton Rouge, LA 70804-4095 

(225) 326-6000 

http://www.ag.state.la.us/ 

Maine 

State House Station 6 
Augusta, ME 04333 
(207) 626-8800 
http://www.maine.gov/ag/ 

Maryland 
200 St. Paul Place 
Baltimore, MD 21202-2202 
(410) 576-6300 

http://www.marvlandattornevgeneral.g 

ov/ 

Massachusetts 
1 Ashburton Place 
Boston, MA 02108-1698 
(617) 727-2200 

https://www.mass.gov/orgs/office-of- 

attomev-general-maura-healev 

Michigan 

P.O. Box 30212 

525 W. Ottawa Street 

Lansing, MI 48909-0212 

(517)373-1110 

http ://w ww. mich i gan. go v/ag 

Minnesota 

75 Dr. Martin Luther King, Jr. 

Boulevard, Suite 102 

Saint Paul, MN 55155 

(651) 296-3353 or 1-800-657-3787 | 

TTY: (651) 297-7206 or 1-800-366- 

4812 

http://www.ag.state.mn.us/ 

Mississippi 
Department of Justice 
P.O. Box 220 
Jackson, MS 39205 
(601)359-3680 
http://www.ago.state.ms.us/ 

Missouri 

207 W. High Street 
Jefferson City, MO 65101 
(573)751-3321 
http://ago.mo.gov/ 
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Montana 
215 N. Sanders 
Helena, MT 59620-1401 
(406) 444-2026 
https://doj.mt.eov/ 

Nebraska 
State Capitol 
P.O. Box 98920 
Lincoln, NE 68509-8920 
(402) 471-2682 
http://www.aeo.ne.eov/ 

Nevada 

100 N. Carson Street 
Carson City, NV 89701 
(775) 684-1100 
http://ae.nv.eov/ 

New Hampshire 
33 Capitol Street 
Concord, NH 03301 
(603)271-3658 

https://www.doi.nh.gov/index.htm 

New Jersey 
25 Market Street 
P.O. Box 080 
Trenton, NJ 08625 
(609) 292-8740 

htto://ni.eov/oae/newsreleasesl8/pr2Q 

180116a.html 

New Mexico 
P.O. Drawer 1508 
Santa Fe, NM 87504-1508 
(505) 490-4060 
https://www.nmag.gov/ 

New York 

The Capitol, 2 nd Floor 
Albany, NY 12224 
(518) 474-7330 
http://www.ae.nv.eov/ 

North Carolina 

P.O. Box 629 

Raleigh, NC 27602-0629 

(919)716-6400 

http://www.ncdoi.eov/ 

North Dakota 

600 E. Boulevard Avenue 

Bismarck, ND 58505-0040 

(701)328-2210 

http://www.ae.state.nd.us 


Ohio 

30 E. Broad Street 
Columbus, OH 43266-0410 
(614) 466-4320 

http://www.ohioattomeveeneral.eov/ 

Oklahoma 
313 NE 21st Street 
Oklahoma City, OK 73105 
(405) 521-3921 
http://www.oae.state.ok.us/ 

Oregon 

1162 Court Street, NE 
Salem, OR 97301 
(503) 378-6002 
http://www.doi.state.or.us/ 

Pennsylvania 

Strawberry Square, 16 th Floor 
Harrisburg, PA 17120 
(717) 787-3391 

https://www.attomevgeneral.eov/ 

Puerto Rico 

Ave. Jos6 De Diego, Pda. 22 
Minillas Government Center 
Torre Norte Building, 7th Floor 
San Juan, PR 00940 
(787) 722-7555 
http://daco.pr.gov/ 

Rhode Island 
150 S. Main Street 
Providence, RI 02903 
(401)274-4400 
http://www.riae.ri.eov/ 

South Carolina 

Rembert C. Dennis Office Building 
P.O. Box 11549 
Columbia, SC 29211-1549 
(803) 734-3970 
http://www.scag.gov/ 

South Dakota 

1302 East Highway 14, Suite 1 
Pierre, SD 57501-8501 
(605)773-3215 
http://ate.sd.eov/ 


Tennessee 

425 5th Avenue North 
Nashville, TN 37243 
(615) 741-3491 

http://www.tn.gov/attomevgeneral 

Texas 

Capitol Station 
P.O. Box 12548 
Austin, TX 78711-2548 
(512)463-2100 

https://www.texasattomeveeneral.eov/ 

Utah 

State Capitol, Room 236 
Salt Lake City, UT 84114-0810 

(801) 538-9600 

http://attomevgeneral.utah.eov/ 

Vermont 

109 State Street 

Montpelier, VT 05609-1001 

(802) 828-3173 
http://aeo.vermont.eov/ 

Virginia 

202 North Ninth Street 
Richmond, VA 23219 
(804) 786-2071 
http://www.oae.state.va.us/ 

Washington 

1125 Washington Street SE 
P.O. Box 40100 
Olympia, WA 98504-0100 
(360) 753-6200 
http://www.atg.wa.gov 

West Virginia 

1900 Kanawha Boulevard, E 
Charleston, WV 25305 
(304) 558-2021 
http://www.wvaeo.eov/ 

Wisconsin 

State Capitol, Room 114 East 
P. O. Box 7857 
Madison, WI 53707-7857 
(608) 266-1221 
http://www.doi.state.wi.us 


Wyoming 

State Capitol Building 
Cheyenne, WY 82002 
(307) 777-7841 

http://attomevgeneral.state.wv.us 
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